The Lakehouse runtime catalog enforces storage location, permission, and security hardening rules when you create and manage tables using the Apache Iceberg REST catalog endpoint. These rules help you isolate underlying storage paths, prevent naming conflicts, and restrict table registration to authorized administrators.
Table location
Table paths must be nested within the parent namespace path (for example,
gs://{namespace_path}/.../{table_name}). This constraint is enforced to help
with security and catalog hardening.
Behavior change for table paths: Note that the resulting table location
(under which the metadata/ folder is created) automatically has a random
string attached as a suffix to prevent conflicts and improve security:
- If no specific location is provided, the resulting location is
gs://{namespace_path}/{table_name}/{random_suffix}. - If a specific location is provided (for example,
gs://{namespace_path}/.../{table_name}), the resulting location isgs://{namespace_path}/.../{table_name}/{random_suffix}.
Table registration permissions
Both multiple-bucket and single-bucket catalogs require the
biglake.tables.register permission to register a table. This permission is
restricted to the BigLake Admin (roles/biglake.admin) role to ensure only
administrators can perform table registration.